For directors

What directors are accountable for on technology, cyber and AI.

Plain-English guidance for boards and owners. Register checked 13 October 2026. General information, not legal advice.

Your duties

A director’s duty of care and diligence under the Corporations Act (section 180) extends to overseeing the risks the company runs in technology, cyber security and AI. A board does not need to run those systems. It does need to know what they are, who is accountable for them, what could go wrong, and what the company is obliged to do about it.

In practice that means the board sees a technology and cyber report on a regular cycle, knows which rules apply to the business, and can show that it asked questions and acted on the answers.

In force Directors’ duties (Corporations Act s 180). Baker McKenzie — ASIC v FIIG Securities

The lesson from ASIC v FIIG Securities

In February 2026 the Federal Court ordered A$2.5M in penalties against an Australian financial services licensee for cyber security failures: multi-factor authentication that was missing, patching that was not done, testing that was not run, staff training that was not delivered, and an incident response plan that had never been tested.

None of those are exotic controls. They are the baseline a regulator now expects a licensee to evidence, and the baseline a board should expect to see reported.

In force ASIC v FIIG Securities [2026] FCA 92, A$2.5M penalty, February 2026. Baker McKenzie — ASIC v FIIG Securities

What’s commencing

  1. Privacy Act automated-decision transparency (APP 1.7–1.9)

    Inventory every automated or AI-assisted decision about customers or staff, and have the privacy policy disclosures drafted before 10 December 2026.

    Commencing OAIC. MinterEllison — OAIC compliance sweep and ADM transparency

  2. Children’s Online Privacy Code

    Decide whether any service you run is likely to be used by under-18s, and if so assign an owner for the Code’s requirements.

    Commencing OAIC. RecordingLaw — Privacy Act reforms timeline

  3. Scams Prevention Framework

    Confirm whether you are in, or a supplier to, a designated sector, and if so track the sector code that will bind you.

    Commencing ACCC (general), ASIC (banks), ACMA (telcos). Ashurst — Scams Prevention Framework draft rules and codes

  4. EU AI Act

    If you have EU customers or users, classify each AI use by risk tier and record who is accountable for it.

    Commencing EU AI Office and national authorities. Gibson Dunn — EU AI Act Omnibus agreement

Register checked: 13 October 2026. See the full Regulatory watch

Questions every board should ask about AI

Mapped to the six practices of the national Guidance for AI Adoption.

  1. 01 · Accountability

    Who in this company is accountable for each use of AI, and does the board know their name?

  2. 02 · Impacts

    Which decisions about customers or staff does AI influence, and who could be harmed if it is wrong?

  3. 03 · Risk

    Where is AI risk recorded, and when did the board last see that register?

  4. 04 · Sharing information

    What do we tell customers and staff about where AI is used and what data it sees?

  5. 05 · Testing and monitoring

    How do we know each AI tool still works as intended, and who checks?

  6. 06 · Human control

    Which decisions can AI make alone, and which need a person to confirm before they take effect?

Board Technology & Regulatory Briefing Book a 20-minute fit call